1

Short Thematic Report

National intelligence authorities and surveillance in the EU: Fundamental rights safeguards and

remedies

Legal update

Country: Spain Version of 28 July 2016 FRANET contractor: Comillas Pontifical University - University Institute of Studies on Migration Author(s) name(s): Cristina J. Gortázar, Nuria Lores and María José Castaño DISCLAIMER: This document was commissioned under a specific contract as background material for the project on National intelligence authorities and surveillance in the EU: Fundamental rights safeguards and remedies. The information and views contained in the document do not necessarily reflect the views or the official position of the EU Agency for Fundamental Rights. The document is made publicly available for transparency and information purposes only and does not constitute legal advice or legal opinion.

2

1 Description of tasks – Phase 3 legal update

1.1 Summary

1.1.1 Legislative reforms

During the reporting period, legislative reforms have been scarce. However, the state of play

regarding the Data Retention Directive will be briefly described, and the reform of the

Criminal Procedure Law will be addressed within this scope. Finally, anti-terrorism

measures are also explained in this section.

a. The question of the Data Retention Directive in Spain.

The Data Detention Directive was implemented by Law 25/2007, of 18 October 2007 on the

retention of data regarding telephone and communication networks1. The Court of Justice of

the European Union (CJEU) in the cases Digital Rights Ireland and Seitlinger and Others2

annulled the Data Detention Directive in 2014, yet the Law on Data Retention regarding

telephone and communication networks remains in force.

Law 9/2014, of 9 May 2014, on Communications3 involves the regulation of

telecommunications which includes the operation of networks providing a service and the

delivery of electronic communications services. Privacy of communications, personal

data protection, rights and public obligations linked to network and electronic

communications services are set out in Chapter III of the Law but, nevertheless, no mention is

made of the Digital Rights Ireland case.

Retained data under Law on data retention regarding telephone and communication networks

could only be transferred to authorised representatives appointed by this legislation, in which

National Intelligence Services (NIS) is expressly mentioned in Article 6 (2) c).

b. Law 13/2015 amending the Criminal Procedure Law strengthening the

procedural guarantees and the regulation of the technological search measures

In 2015, the Spanish Ministry of the Presidency adopted Law 13/2015 amending the

Criminal Procedure Law strengthening the procedural guarantees and the regulation of the

technological research measures4. The issues facing the present law are the following:

2 1 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2007), Law on data retention regarding

telephone and communication networks (Ley 25/2007, de 18 de octubre, de conservación de datos relativos a las

comunicaciones electrónicas y a las redes públicas de comunicaciones). Press release, 19 October 2007, available

at: https://www.boe.es/buscar/act.php?id=BOE-A-2007-18243 2 Court of Justice of the European Union (CJEU), Digital Rights Ireland and Seitlinger and Others,

Nos. 293/12 and 594/12, 8 April 2014. 3 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2007), Law on Communications (Ley 9/2014,

de 9 de mayo, General de Telecomunicaciones). Press release, 10 May 2014, available at:

https://www.boe.es/diario_boe/txt.php?id=BOE-A-2014-4950 4 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2015), Law 13/2015 amending the

Criminal Procedure Law strengthening the procedural guarantees and the regulation of the technological research

measures (Ley Orgánica 13/2015, de 5 de octubre, de modificación de la Ley de Enjuiciamiento Criminal para el

3

- on the one hand, strengthening the rights due process in accordance with the

requirements of the law of the European Union - specifically Directive 2013/48/EU of

the European Parliament and of the European Council of 22 October 2013 on the

right of access to a lawyer in criminal proceedings and in European arrest warrant

proceedings, and on the right to have a third party informed upon deprivation of

liberty, and to communicate with third persons and with consular authorities while

deprived of liberty5-;

- and on the other hand, the regulation of measures on technological research with

respect for fundamental rights, in particular, regarding economic, social and cultural

rights. Specifically the right to privacy, communications privacy, and

personal data protection are guaranteed by the Spanish Constitution.

In Spain, the legislative framework in surveillance includes the Spanish Constitution. Indeed,

Article 18 (3) of the Spanish Constitution recognises the right of privacy of

communications, and especially of the confidentiality of postal, telegraphic and telephone

communications; except where judicial authority authorises interception of such information.

The methods and cases with the ability to individually terminate this right are set out in

Article 55 (2) and always require judicial intervention and an appropriate level of

parliamentary control. Lastly, the right to effective legal protection is a fundamental right

enshrined in Article 24.

The establishment of new measures on technological investigation is directly related to

surveillance. In this regard, Law 13/2015 modifies Title VIII of the Criminal Procedure Law -

renamed “investigative measures of the rights recognised by Article 18 of the

Spanish Constitution”- and is divided into ten chapters.

The first three chapters contain criminal investigations which have already presented in the

Criminal Procedure Law: “Entering and searching behind closed doors” (Article 545 and

Article 572); “Books and papers searching” (Article 573 and Article 578); and “Detention and

opening of written or telegraphic correspondence” (Article 579 to Article 588). In this last

chapter, some clarifications have been included, such as correspondence by fax, burofax or

postal order. In addition, the crimes for which these investigations can be claimed appear in

Article 579. These are intentional crimes with maximum penalties of over 3 years of prison,

offences committed by a criminal organisation, and terrorist offences. In addition,

Article 579 bis has been introduced on the use of information obtained in a different

proceeding, and casual discoveries due to these criminal investigations.

Chapter IV is the general overview part, setting common provisions applying to all measures

on technological investigation covered by this Law. The Guiding Principles on technological

investigation standards are set forth by the Spanish Constitutional Court on the measures of

technological investigation: suitability, exceptionality, necessity and proportionality

(Article 588 bis a). Formal aspects such as the content of the request, the Court ruling, the

request for the extension, the General rules of the duration (3 months), secrecy, control

measures, how third parties may be affected, the use of information in different proceedings,

and the cessation of the measure, or the destruction of records, are also addressed in this

chapter.

The other measures on technological investigation are provided in the new Chapters V to X.

The interception of telephone and telematic communications is extended to any two-way

telematic communication system -such as WhatsApp,- SMS and covert listening devices (Chapter V, Article 588 ter a) and Article 588 ter m) ; the reception and recording of oral

fortalecimiento de las garantías procesales y la regulación de las medidas de investigación tecnológica). Press

release, 6 October 2015, available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2015-10725 5 OJ 2013 L 294 of 6 November 2013, p. 1-12.

4

communications through the use of electronic devices (Chapter VI, Article 588 quarter a) to

Article 588 quarter e)); the use of technical devices of imaging, tracking and location

(Chapter VII, Article 588 quinquies a) to Article 588 d c)); the registration of devices of mass

storage (Chapter VIII, Article 588 sexies a) to Article 588 sexies c)); remote logs on

computers which introduce the concept of undercover agents on the web under false

identities (Chapter IX, Article 588 septies a) to Article 588 septies c)) and, assurance

measures (Chapter X, Article 588 g).

c. The reinforcement of the fight against terrorism: CITCO

The basic structure of the Spanish Ministry of the Interior was amended in 2014 by the

Council of Ministers and the Intelligence Centre against Terrorism or Organised Crime

(Centro de Inteligencia contra el Terrorismo y el Crimen Organizado, CITCO), having been

created by Royal Decree 873/2014 amending Royal Decree 400/2012, which develops the

basic organic structure of the Ministry of Interior. 6

With this modification, the Intelligence Centre against Organised Crime

(Centro de Inteligencia contra el Crimen Organizado, CICO) and the Spanish

National Centre for Antiterrorist Coordination (Centro Nacional de

Coordinación Antiterrorista, CNCA) integrates them into a single body.

The purpose of this change is to improve information exchange between specialised agencies

in analysing the threat from terrorism, organised crime and violent radicalism. In this new

context, CITCO is the body of reception, integration and analysis of all available strategic

information related to terrorism, organised crime and violent radicalism, developing strategic

and prospective intelligence, providing an assessment of these constantly updated threats,

proposing and coordinating national strategies for combat, and establishing performance

criteria and operational coordination among agencies in cases of overlapping or duplication in

the research undertaken against these phenomena .

1.1.2 Relevant Case Law

In Spain, Spanish case law does not accurately reflect the case Digital Rights Ireland and

Seitlinger and Others (CJEU). There is also no constitutional declaration by the Spanish

Constitutional Court regarding Law 25/2007, of 18 October 2007 on data retention regarding

telephone and communication networks, which is the norm implemented by the

Data Detention Directive.

In the same vein, all national authorities in the interviews carried out for this update have not

informed us either of any relevant court decisions regarding surveillance.

1.1.3 Oversight bodies’ reports and enquiries

In Spain, the Snowden case has had a very limited impact on legislation, academia or

stakeholders in the reporting period.

4 6 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2014), Royal Decree 873/2014 amending

Royal Decree 400/2012 which develops the basic organic structure of the Ministry of the Interior

(Real Decreto 873/2014, de 10 de octubre, por el que se modifica el Real Decreto 400/2012, de 17 de febrero, por

el que se desarrolla la estructura orgánica básica del Ministerio del Interior). Press release, 14 October 2014,

available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2014-10398

5

At parliamentary level, it should be stressed that, although the committees’ meetings, called

Session's Dairy (Diario de Sesiones) are reproduced in the official web site of the Congress, 7according to Article 96 of the Regulations of the Congress of Deputies,8 the secret

committees are not public, such as the Resources Reserve Committee (Comisión de control de

los créditos destinados a gastos reservados, usually called Comisión de Secretos Oficiales).

Nevertheless, there are verbatim records of the secret hearings in a single copy which is

guarded by the President of the committees whose proceedings shall be regarded as secret.

This copy will be able to be consulted by Deputies but subject to the agreement of the Table

(Art. 96. (2)). In this sense, Deputies at Congress are legally required under the obligation of

discretion and confidentiality set out in Article 16 of the Regulations of the Congress of

Deputies.

The aforementioned Committee of the Spanish Parliament has access to classified matters. It

is specifically mentioned in Article 11 of Act 11/2002, of 6 May, on the National Intelligence

Centre (CNI) – the legal doctrine according to which the CNI shall inform the Spanish

Parliament, through the Committee controlling loans destined to reserved expenditure and

chaired by the President of the Chamber, of appropriate information on the running and

activities of intelligence objectives assigned by the Government, with an annual activity

report, and of the situation and degree of compliance with the objectives mentioned above.

This information is not public and is only available to the members of those members of

Resources Reserve Committee.

In other fields we cite -as an example- one of the articles which makes reference to Snowden,

FBI vs. Apple: the battle for the encryption. This article was published by ELCANO Royal

Institute and basically focuses on the lack of cooperation between the FBI and Apple 9

In the area of the mass media, the impact of the Snowden case has been greater and the

Snowden case was able to appear on newspapers and television, such as the interview

between the journalist, Ana Pastor, and Edward Snowden on the TV show “El objetivo”10.

Finally, the Ombudswoman has no executive power, but a will to influence. It's a mediator

institution between citizens and public administrations. They are neutral and active. They

have got authority (autoritas), but not power (potestas). Despite not having executive power,

they have four powers: turn up to any public office; interview under protest any public

official; interview under protest any person imprisoned; and gain access to any kind of

documents.

5 7 Official web site of the Congress,

http://www.congreso.es/portal/page/portal/Congreso/Congreso/Organos/Comision (Hyperlink was

accessed on 7 July 2016) 8 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (1982), Regulations of the Congress of Deputies

(Resolución de 24 de febrero de 1982 por la que se ordena la publicación en el «Boletín Oficial del Estado» del

nuevo Reglamento del Congreso de los Diputados). Press release, 5 March 1982, available at:

https://www.boe.es/diario_boe/txt.php?id=BOE-A-1982-5196

9 Spain, FBI vs. Apple: the battle for the encryption (FBI vs. Apple: la batalla por el cifrado) by Enrique Fojón

Chamorro, 4 March 2016, available at: http://www.blog.rielcano.org/fbi-vs-apple-la-batalla-por-el-cifrado/ 10 Spain, El objetivo interviews Edward Snowden (El objetivo entrevista a Edward Snowden), La Sexta,

13 March 2016, available at:

http://www.lasexta.com/programas/el-objetivo/noticias/entrevista-completa-edward-snowden-objetivo-version-

extendida_20160313572398a04beb28d446ffed10.html

6

In the framework of its activities, the Ombudswoman's office treat complaints by individuals

in relation to activities conducted by the police but not in the NIS. In addition, complaints

received by the Ombudswoman's office concerns the code of criminal procedure with respect

to fundamental rights, such as the one of intimacy, the one of communications privacy, and

the one of one's own image has been very low (1 or 2).

1.2 International intelligence services cooperation

1.2.1 International cooperation between intelligence services

Standards essential for the procedure in transmitting and sharing classified information are

provided for in the agreements for the protection of classified information between Spain and

other countries, and with international organisations. At this point, agreements with the

European Union11, the North Atlantic Treaty Organization (NATO)12, the

European Space Agency (ESA)13, the European Rapid Operational Force (Eurofor)14 and the

Organisation for Joint Armament Cooperation (OCCAR)15 are referred to, among other

agreements.

On the other hand, the National Security Office is the body responsible for representing the

Spanish Intelligence Services in committees and working groups as established by

Norm NS/04 of the National Security Office for the Protection of Classified Information

(Point 5 (2)).16 There is information in this regard at the official

Spanish National Centre of Intelligence web site,17 such as a definition of classified

information or the functions and history of the National Security Office. At this website there

6 11 Spain, Ministry of Foreign Affairs and Cooperation (Ministerio de Asuntos Exteriores y Cooperación) (2015)

Agreement among the member states of the European Union on the protection of classified information (Acuerdo

entre los Estados miembros de la Unión Europea, reunidos en el seno del Consejo, sobre la protección de la

información clasificada intercambiada en interés de la Unión Europea, hecho en Bruselas el 25 de mayo de 2011)

Press release, 25 November 2015, available at: https://www.boe.es/boe/dias/2015/11/25/pdfs/BOE-A-2015-

12736.pdf 12 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (1982), Accession of the Kingdom of Spain to

the North Atlantic Treaty Organization (Instrumento de Adhesión del Reino de España al

Tratado del Atlántico Norte). Press release, 31 May 1982, available at:

http://www.boe.es/buscar/doc.php?id=BOE-A-1982-12535 13 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2005), Accession of the Kingdom of Spain to

the European Space Agency (Instrumento de Ratificación del Acuerdo entre los Estados parte en el Convenio para

el establecimiento de una Agencia Espacial Europea y la Agencia Espacial Europea para la protección y el

intercambio de información clasificada, hecho en París el 19 de agosto de 2002). Press release, 3 March 2005,

available at: http://www.boe.es/diario_boe/txt.php?id=BOE-A-2005-3510 14 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2010), Accession of the Kingdom of Spain to

the European Rapid Operational Force (Instrumento de Ratificación del Acuerdo de Seguridad entre la

República Francesa, la República Italiana, la República Portuguesa y el Reino de España para la protección de la

información clasificada de EUROFOR, hecho en Roma el 11 de octubre de 2007). Press release, 2 October 2010,

available at: http://www.boe.es/diario_boe/txt.php?id=BOE-A-2010-15118&lang=en 15 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2008), Accession of the Kingdom of Spain to

the Organisation for Joint Armament Cooperation (Instrumento de Adhesión de España al Acuerdo de Seguridad

de la OCCAR entre el Gobierno de la República Francesa, el Gobierno de la República Federal de Alemania, el

Gobierno del Reino de Bélgica, el Gobierno de la República Italiana y el Gobierno del Reino Unido de

Gran Bretaña e Irlanda del Norte, hecho en París el 24 de septiembre de 2004). Press release, 1 May 2008,

available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2008-7707&lang=gl 16 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2014), Norm NS/04 of the

National Security Office for the Protection of Classified Information (Normas de la Autoridad Nacional para la

Protección de la Información clasificada). Available at:

https://www.cni.es/comun/recursos/descargas/Normas_de_la_Autoridad_Nacional_para_la_Proteccion_de_la_Info

rmacion_Clasificada.pdf 17 https://www.cni.es/es/ons/introduccion/ Hyperlink was accessed on 18 April 2016.

7

is also at a document where the basic protection of classified information principles are

collected.18

In any case, the Spanish National Security Office is also actively participating in related

international fora in order to analyse and agree on international standards for classified

information protection. The European Union, the European Space Agency (ESA), the

Multinational Industrial Security Working Group (MISWG), the

Organisation for Joint Armament Cooperation (OCCAR) or the

North Atlantic Treaty Organization (NATO) are some examples of partnering organisations.

In addition to the above, the Spanish National Security Office works closely with other

national security authorities. Within this activity, the Spanish National Security Office also

maintains close contact with the security departments of international organisations in

classified information protection. A key role for the Spanish National Security Office is

maintaining relevant contacts with other national safety authorities in third countries and they

must ensure protection of not national classified information handled within their borders, as

well as national classified information which is handled outside Spanish borders.

Finally, mention should be made to the 1988 Convention for Cooperation on defence

cooperation between Spain and the United States19 and its successive protocol amending the

Convention adopted in 2002,20 201221and 201522. The objective of this Convention is to

authorise and regulate the use of military bases by the United States in Spain. In this context,

it is important to point to Article 18 of the Convention, establishing that any information of

strategic interest for Spain shall be reported to the Spanish Government when it has been

obtained from these American military bases also known as “support facilities IDAS”.

1.2.2 Overseeing international cooperation agreements

In Spain, no Spanish authority is legally competent to monitor the activities of foreign

intelligence services. There is also no information of how competent authorities within the

international cooperation agreements, the data exchanged between the services and any joint

7 18 Spain, Basic principles concerning protection of classified information (Principios basicos de la

informacion clasificada) available at:

https://www.cni.es/comun/recursos/descargas/Proteccion_de_la_Informacion_Clasificada.pdf

19 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (1988), Convention for cooperation on defence

cooperation between Spain and the United States (Convenio entre el Reino de España y los

Estados Unidos de América sobre Cooperación para la Defensa, anejos y canjes de notas anejas al mismo, hecho

en Madrid el 1 de diciembre de 1988). Press release, 6 May 1989, available at:

https://www.boe.es/diario_boe/txt.php?id=BOE-A-1989-10178 20 Spain, Ministry of the Presidency, (Ministerio de la Presidencia) (2000), Protocol of amendment the Convention

for cooperation on defence cooperation between Spain and the United States (Protocolo de 10 de Abril de 2002 de

enmienda del convenio de cooperación para la defensa entre el Reino de España y los

Estados Unidos de América, de 1 de Diciembre de 1988). Press release, 21 February 2003, available at:

https://www.boe.es/diario_boe/txt.php?id=BOE-A-2003-3595

21 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (1988), Second Protocol of amendment the

Convention for cooperation on defence cooperation between Spain and the United States (Segundo Protocolo de

enmienda del Convenio de Cooperación para la defensa entre el Reino de España y los

Estados Unidos de América, de 1 de diciembre de 1988, revisado, hecho en Bruselas el 10 de octubre de 2012).

Press release, 10 June 2013, available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2013-6102

22 Spanish Ministry of the Presidency (Ministerio de la Presidencia) (2015), Third Protocol of amendment the

Convention for cooperation on defence cooperation between Spain and the United States (Tercer Protocolo de

Enmienda del Convenio de Cooperación para la Defensa entre el Reino de España y los

Estados Unidos de América, de 1 de diciembre de 1988, y sus Enmiendas). Press release, 11 June 2015, available

at: http://www.boe.es/buscar/doc.php?id=CE-D-2015-550

8

surveillance activities, are subject to oversight in Spain. However, reference must be made to

the parliamentary and judicial control on this issue.

It can, therefore, be stated that the parliamentarian body exercise its oversight powers with

regard to data that were originally collected in a foreign country and transferred to the

Spanish NIS on the basis of international cooperation agreements.

1.3 Access to information and surveillance

In Spain, the access to information related to the activity of the national intelligence

authorities and surveillance by individuals is not regulated as a constitutional right in the

Spanish Constitution23, where only mention is made of citizens' access to administrative

files and records in Article 105 b) in order to clarify that this kind of access shall be regulated

by law.

In this sense, the Law 19/2013 on Transparency, Access to Public Information and Good

Governance24 was recently approved with the aim of guaranteeing the citizens' access to

public information. However, under this Law information related to the activity of the

national intelligence authorities and surveillance should not be considered public information,

since in accordance with the Law on Transparency public information should be understood

by contents or documents relating of the activities of bodies and agencies as defined in the

Law (Art. 13). The Spanish Judicial Power, the Spanish Parliament, the Spanish

Tax Agencies and the Spanish Ombudsman are among the bodies and agencies listed in the

Law, which never included the Spanish National Intelligence Centre.

Finally, regarding the access to information by individuals must also be mentioned the

Ombudsman who possess the capabilities to bridge the gap between individuals and public

administrations. In this context, the Ombudsman itself can get access to any kind of

documents on a request of citizen and request information for data (except regarding

classified information collected/processed by the Spanish National Intelligence Centre). The

citizen can access the Ombudsman through various channels. Nowadays, the main one is the

web (there is an online form for complaints). Once the form is received, it is registered and

introduced into the computer system for file management (GEX). From this moment,

according to the Article 22 of the Ombudsman Law,25 the Ombudsman may ask the public

authorities all documents deemed necessary for the development of its function, including

those classified with the nature of secrets in accordance with the law. In the latter case no

remission of such documents shall be agreed by the Council of Ministers and accrediting

certification of the agreement refused must be accompanied. In this context, the law also

allows specific protective measures the Ombudsman understand that a document declared

secret and not referred by the Administration could affect a decisive contribution to conduct

an enquiry, it shall notify the committees of the Congress and the Senate (Article 22 (3).

The Ombudswoman's office is organised into 6 areas of competence: security and justice

(interviewed here); economic activity, equal treatment and migration; education

8 23 Spanish Ministry of the Presidency (Ministerio de la Presidencia) (1978), Spanish Constitution

(Constitucion Española). Press release, 29 December 1978, available at:

https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 24 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2013), Law 19/2013 on Transparency, Access

to Public Information and Good Governance (Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la

información pública y buen gobierno). Press release, 10 December 2013, available at:

https://www.boe.es/buscar/act.php?id=BOE-A-2013-12887

25 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (1985), Ombudsman Law

(Ley Orgánica 3/1981, de 6 de abril, del Defensor del Pueblo). Press release, 2 July 1985, available at:

https://www.boe.es/buscar/act.php?id=BOE-A-1985-12666

9

(data protection); town planning and environment; and health and national insurance.

Currently, they are studying how to implement this in the social networks.

1.4 Update the FRA report

Introduction Spain is not mentioned in the introductory section.

1. Intelligence services and surveillance laws

1.1. Intelligence services

The mention of Spain on page 14 is accurate.

In Spain, the Council of Ministers approved the modification of the basic structure of the

Ministry of the Interior on 10 October 2014, creating the Intelligence Centre against

Organised Crime or Terrorism (CITCO). CITCO is the body of reception, integration and

analysis of all available strategic information related to terrorism, organised crime and violent

radicalism, developing strategic and prospective intelligence, providing an assessment of

these constantly updated threats, proposing and coordinating national strategies for combat,

and establishing performance criteria and operational coordination among agencies in the

cases of overlapping or duplication in the research undertaken against these phenomena.

1.2. Surveillance measures

The mention of Spain on page 16 is accurate.

1.3. Member states’ laws on surveillance The reference in the text on page 20 is accurate. The footnote referring to “Spain” on page 20

is accurate.

However Spain is not mentioned in Section 1.3.1. Surveillance “in accordance with the law”

and the Spanish case is an example of a complex framework. In Spain, the legal framework

relating to surveillance and access to information includes the Spanish Constitution as well as

the regulation of bodies and agencies with activities relating to the fundamental rights

compliance in the area of surveillance. These institutions are the

Spanish National Intelligence Centre, the Spanish Judicial Power, the Spanish Parliament, the

Spanish Data Protection and Tax Agencies, and the Spanish Ombudsman.

FRA key findings

Spain is not mentioned in this section of the report, and there is nothing new to add.

2. Oversight of the intelligence services

2.1. Executive control

Spain is not mentioned in this section of the report but the right to access information is

described in detail under Section 1.3 of the present report (see p. 20).

In Spain the Government Commission for intelligence that Article 6 of Law 11/2002 of May

6 refers to, have the following composition:

a) The Deputy Prime Minister and Minister of the Presidency, who will preside.

10

b) Ministers of Foreign Affairs and Cooperation, Defence, Interior and Economy and

Competitiveness.

c) The Director of the Office of the Prime Minister, the Secretary of State for Security and the

Secretary of State Director of the National Intelligence Center, which will act as Secretary.

2. Notwithstanding the provisions of the preceding paragraph, may be invited to meetings of

the Commission other holders of those governing bodies and directors of the General State

Administration that is deemed appropriate. Undersecretary of the Presidency will be

summoned to meetings of the Government Commission for Intelligence Affairs.

3. Correspond to the Government Commission for intelligence competencies set out in Article

6.4 of Law 11/2000, of 6 May.

2.2. Parliamentary oversight

2.2.1 Mandate

The information for Spain on page 39 remains accurate.

Although we could refer to the Resolution of the Presidency of the Spanish Parliament on

Official Secrets… citing, “Other parliamentary committees may hold hearings with members

of the executive or intelligence services”.

2.2.2 Composition The information on Spain on page 39 remains accurate. The footnote referring to “Spain” on

page 39 is accurate.

2.2.3 Access to information and documents

Spain is not mentioned in this section of the report.

2.2.4 Reporting to parliament Spain is not mentioned in this section of the report.

2.3. Expert oversight

2.3.1 Specialised expert bodies

Spain is not mentioned in this section of the report.

2.3.2 Data protection authorities

The references to Spain on page 47 remain accurate.

2.3.4. Approval and review of surveillance measures

The reference to Spain on page 53 is accurate. The footnote referring to “Spain” on page 54 is

accurate.

FRA key findings

Nothing new to add.

3. Remedies

3.1. A precondition: obligation to inform and the right to access

11

The references to Spain on page 62 are not accurate.

The reference is not in accordance with the law, as we pointed out that Article 25 of

Royal Decree 1720/2007 on Personal Data Protection26 provides general information to the

person about searching for data. However, the exercise of the rights of access, rectification,

erasure, and objection may be modulated for reasons of public safety in the cases, and within

the scope provided at law (Article 25 (7) of Royal Decree 1720/2007). The reference to Spain

is more akin to those Member states that provide restrictions on grounds of national security

grounds.

In any case, as noted by the Spanish Agency for Data Protection Data, it is important that

people realise that they are subject to surveillance. In the scope of the intelligence services, it

is sensitive because it is more difficult to know and verify that there has been an infringement

of rights (data protection, right to privacy, etc.). Given the very nature of intelligence actions,

one realises that one’s rights have been infringed when one sees the consequences. For

example, the visa is denied, or the nationality is denied. A report by the CNI is compulsory

before nationality can be issued. If this report is negative, one can have access to the reasons;

however, one can also be unaware of these, and realise that something has failed. In this case,

one can resort to taking court action in the light of the Spanish Supreme Court's doctrine

about the denial of nationality, and the CNI accessing to data.

3.2. Judicial remedies

3.2.1 Lack of specialisation and procedural obstacles

Spain is not mentioned in this section of the report.

In Spain, there are no specialised judges appointed for surveillance cases. In accordance with

Article 24 of the Spanish Constitution, every person has the right to obtain effective

protection of the Judges and the Courts in the exercise of his or her legitimate rights and

interests, and in no case may he/she go undefended. In this sense, any citizen considering

his/her fundamental rights have been violated can request the protection of these rights before

ordinary courts by means of a proceeding based on the principles of preference and summary,

and, when appropriate, by means of an appeal for legal protection before the

Constitutional Court.

Likewise, any person considering that rights provided for in the Spanish Constitution have

been infringed can resort to the Ombudsman. This institutional figure acts with total

independence and autonomy, and enjoys immunity.

3.2.2 Specialised judges and quasi-judicial tribunals

Spain is not mentioned in this section of the report.

3.3. Non-judicial remedies: independence, mandate and powers

3.3.1. Types of non-judicial bodies Spain is not mentioned in this section of the report.

3.3.2. The issue of independence

Spain is not mentioned in this section of the report.

11 26 Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2007) Royal Decree 1720/2007 on

Personal Data Protection (Real Decreto 1720/2007, de 21 de diciembre, por el que se aprueba el Reglamento de

desarrollo de la Ley Orgánica 15/1999, de 13 de diciembre, de protección de datos de carácter personal). Press

release, 19 January 2008, available at: https://www.boe.es/buscar/doc.php?id=BOE-A-2008-979

12

3.3.3. Powers and specialisation of non-judicial remedial bodies

The reference to Spain on page 72 is accurate.

FRA key findings

Nothing new to add.

Conclusions Nothing new to add.

Bibliography/References

The references to Spain on page 91 remain accurate, but some references would need to be

added:

Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2007), Law on retention of

data regarding telephone and communication networks (Ley 25/2007, de 18 de octubre, de

conservación de datos relativos a las comunicaciones electrónicas y a las redes públicas de

comunicaciones). Press release, 19 October 2007, available at:

https://www.boe.es/buscar/act.php?id=BOE-A-2007-18243

Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2007), Law on

Communications (Ley 9/2014, de 9 de mayo, General de Telecomunicaciones). Press release,

10 May 2014, available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2014-4950

Spain, Ministry of the Presidency (Ministerio de la Presidencia) (2015), Law 13/2015

amending the Criminal Procedure Law strengthening the procedural guarantees and the

regulation of the technological research measures (Ley Orgánica 13/2015, de 5 de octubre, de

modificación de la Ley de Enjuiciamiento Criminal para el fortalecimiento de las garantías

procesales y la regulación de las medidas de investigación tecnológica). Press release,

6 October 2015, available at: https://www.boe.es/diario_boe/txt.php?id=BOE-A-2015-10725

Spain, Ministry of Foreign Affairs and Cooperation

(Ministerio de Asuntos Exteriores y Cooperación) (2015) Agreement among the

Member states of the European Union on the protection of classified information (Acuerdo

entre los Estados miembros de la Unión Europea, reunidos en el seno del Consejo, sobre la

protección de la información clasificada intercambiada en interés de la Unión Europea,

hecho en Bruselas el 25 de mayo de 2011) Press release, 25 November 2015, available at:

https://www.boe.es/boe/dias/2015/11/25/pdfs/BOE-A-2015-12736.pdf

Legal instruments index – national legislation/case law

Spain is not mentioned in this section of the report.

1.5 Check the accuracy of the figures and tables published in the FRA report (see

the annex on Figures and Tables)

1.5.1 Overview of security and intelligence services in the EU-28

Civil

(intern

al)

Civil

(extern

al)

Civil (internal and

external)

Military

E National Intelligence Cent Intelligence Centre of the Armed Forc

13

S re

/Centro Nacional de Inteli

gencia (CNI)

es

/Centro de Inteligencia de las Fuerzas

Armadas (CIFAS)

In accordance with Act 11/2002, of 6 May, on the National Intelligence Centre, as well as

with Ministerial Order DEF/166/2015, of 21 January, on the basic organisation of the

Spanish Armed Forces and on the operation of the CIFAS, strictly speaking there are just two

intelligence services in Spain: the CNI (strategic nature and national scope) and the CIFAS

(military-type intelligence and departmental scope).

The Spanish Regional Police work seeks to facilitate decision -making by police officials

produced by providing intelligence to enhance a police service that it is every day more

effective and efficient in a changing environment products. All of them have a recently

restructuration: Ertzaina Law 20th November 2013; the State Police intelligence Services

Law 872/2014; the Spanish Civil Guard on 2007.

For example, the Special Central Unit numer 2 (UCE-2) from Spanish Civil Guard, Had 62

agents dedicated to fighting Islamic terrorism in Madrid , even if the forecasts are met Inside

this number will increase by 150 agents, 50 agents to more short term . They applyed the

techniques of the intelligence cycle , they collect, analyze and produce information related to

their respective area of informative responsibility for operational use , either through the

investigation of prosecution of a criminal nature ( by themselves or in coordination with the

judicial police units Corps ) or through the appropriate dissemination .

1.5.2 Figure 1: A conceptual model of signals intelligence

According to Article 5.1 of Law 11/2002, to the Spanish Official Secrets Law, and to

International Agreements on the same, “all activities pertaining to the

Spanish Intelligence Centre (CNI) such as its internal organisation and structure, its resources

and procedural mechanisms, personnel, facilities, databases and data centres, sources of

information, including information or data which might lead to knowledge of the

aforementioned matters, is considered to be classified material and is “top secret”, ie.it enjoys

the highest degree of intelligence secrecy conferred by these laws and International

Agreements.

In this regard, it should be warned that this legal classification says that, as a secret, it is not

possible to describe the data collection and processing mechanisms of the CNI. In any case, it

should be mentioned that the CNI is governed by the principle of acquiescence and carries out

its specific activities within the framework of the qualifications specifically provided for in

Act 11/2002, of 6 May, on the CNI, and Organic Act 2/2002, of 6 May 6, on prior judicial

control of the National Intelligence Centre.

The CIFAS refers to the mechanisms for obtaining data as matching all specialised areas of

intelligence: Human or HUMINT, regarding signs or SIGINT, regarding images or

IMINT, regarding open sources or OSINT, etc. Data processing is carried out in accordance

with the elaboration phase of the intelligence cycle, in which an analysis, an assessment, and

an interpretation of available information from all mentioned scopes are carried out in order to

facilitate decisions through the provision of intelligence coming in the form of advice.

signal

14

1.5.3 Figure 2: Intelligence services' accountability mechanisms

As established in Article 1 of Act 11/2002, the Spanish National Intelligence Centre is the

public body responsible for providing the Spanish President of the Government with

information, analysis, studies and proposals that allow the prevention and avoidance of any

danger, threat, and aggression against Spain's territorial independence and integrity, national

interests and the stable rule of law, and its institutions.

The CIFAS is accountable to the CNI and other national and international services, as well as

to international bodies on this matter.

1.5.4 Figure 3: Forms of control over the intelligence services by the executive across the

EU-28

With respect to superior bodies of the CNI, it should be pointed out that, apart from the

internal control carried out by the CNI itself, there are effective external control bodies

(belonging to the government, the judiciary and the parliament), on activities, their adaptation

to the set of laws, and the degree of efficacy in the achievement of the proposed objectives.

15

Regarding the Government's control over the CNI, it should be mentioned that there is a

Government Delegate Commission for Intelligence Affairs (chaired by the Vice President of

the Government and made up of the Ministers of Foreign Affairs, of Defence, of the Interior,

and Finance, as well as the Secretary-General of the Presidency, the Secretary of State for

Defence, and the Secretary of State-Director of the National Intelligence Centre) responsible

for the monitoring and evaluation of the development of the CNI's objectives.

The CNI is subject to both political and economic control by the Spanish Parliament. The

Parliament controls the CNI in various manners depending on the degree of confidentiality of

the matter subject to control.

When matters are not classified, the parliamentary political control is carried out through any

member of the Congress (requesting a commission of investigation). The

Spanish Intelligence Centre (CNI) is subject to both the political and economic control of the

Spanish Parliament, which controls the CNI in different ways depending on the degree of

secrecy and confidentiality surrounding a particular matter under control. When material is

not classified, parliamentary political control is carried out as normal via parliamentary

commissions and questioning.

Regarding parliamentary control on classified matters of the CNI, the Resolution of the

Presidency of the Spanish Parliament on Official Secrets, of 11 May 2004 (released in the

Official Gazette of the Spanish Parliament), provides the set of rules and determines the way

in which the Spanish Parliament can have access to official secrets.

This Resolution stipulates that the Commissions and the Groups comprising, at least, a quarter

of all members of the Spanish Parliament may gather information from classified matters

through the Presidency of the Chamber.

With respect to the economic parliamentary control, the annual drafting and approval of the

General Budget, in which the State's incomes and expenses are determined, constitute a first

general control, as it establishes specifically the amounts which, being "reserved funds", are

assigned to the Ministries of Foreign Affairs and Cooperation, of Defence, of the Interior, and

to the National Intelligence Centre dependant on the Ministry of the Presidency. Likewise, the

General Budgetary Act stipulates the procedures of justification and the control of expenses

made a priori by the General Intervention of the State Administration, dependent on the

Ministry of Finance, and a posteriori by the Court of Auditors.

The legal system and the specific parliamentary control of reserved funds are envisaged in

Act 11/1995, of 11 May. Reserved funds are defined in it as those intended for the defrayment

of expenses necessary for the State's defence and security. The Act also determines which

Ministries can have the use of them, such as the Ministry of Foreign Affairs, of the Interior,

and of Defence, and the National Intelligence Centre. All information regarding them is

classified secret.

Likewise, the Act regulates direct parliamentary control over the use of these funds through a

Parliamentary Commission consisting of the Chairman of the Congress and those Members of

the Spanish Parliament with access to official secrets. The Commission's sessions are held in

camera and its members cannot disclose any kind of information. The Act also provides for

the obligation of those holding office in a Ministry and having reserved expenditure items

assigned to inform the Commission about the use of these funds on a six-monthly basis.

CIFAS has a mandatory and previous control from the Chief of the Defence Staff by means of

approval of the Military Intelligence Joint Plan (PCIM), a posteriori with the activity report

submitted to the CNI and put before the Government Delegate Commission for

Intelligence Affairs.

16

1.5.5 Table 1: Categories of powers exercised by the parliamentary committees as

established by law

The aforementioned Commission of the Spanish Parliament has access to classified matters. It

is specifically mentioned in Article 11 of Act 11/2002, of 6 May, on the

National Intelligence Centre (CNI) stating legal doctrine according to which the CNI shall be

subject to the knowledge of the Spanish Parliament, with the Commission being chaired by

the President of the Chamber and controlling loans destined to reserved expenditure, as well

as controlling appropriate information on the running and activities and of the intelligence

objectives assigned by the Government together with an annual activity report, it is not a

public report. The Commission will further control the situation and the degree of compliance

with the objectives mentioned above.

Member State Essential powers Enhanced powers

ES X

1.5.6 Table 2: Expert bodies in charge of overseeing surveillance, EU-28

EU Member State Expert Bodies

ES N.A.

1.5.7 Table 3: DPA's powers over national intelligence services, EU-28

It should be noted that, according to what is provided for in Law 15/1999, of 13 December, on

personal data protection, the personal data protection system does not apply to files subject to

the set of regulations on the protection of classified matters and, therefore, neither does it

apply to the CNI. Consequently, the powers of the Spanish Data Protection Agency, to which

the legal system on personal data protection refers, do not extend to the CNI's activity.

17

1.5.8 Figure 4: Specialised expert bodies and DPAs across the EU-28

Figure 4 below shows an accurate description of the specialised expert bodies of the Spanish

system and the Spanish Data Protection Agency.

1.5.9 Table 4: Prior approval of targeted surveillance measures, EU-28

According to Law 2/2002, of 6 May, on prior judicial control of the CNI, the

Secretary of State-Director of the CNI shall apply to Senior Judges of the Supreme Court, in

accordance with the Law on the Spanish Judiciary, for authorisation to adopt measures that

may affect the inviolability of the home, and the secrecy of communications, as long as these

measures be necessary for the compliance with the duties assigned to the centre.

The application for authorisation shall be submitted in writing according to the following

criteria:

a) A specification of requested measures.

b) The facts on which the application is based, the purposes motivating it and the

reasons advising the adoption of requested measures.

c) The identification of the person or persons affected by the measures, if known, and

the establishing of a place where they shall be carried out.

d) The length of the requested measures, which cannot exceed 24 hours in cases where

they affect the inviolability of the home, and three months for the intervention of

postal communications, for wire-tapping, for electronic eavesdropping, and other

means of communication. Both periods may be extended for equal successive

periods, if necessary.

The Senior Judge shall decide, by means of a properly reasoned order within a period

of 72 hours that cannot be extended, the concession of the requested authorisation.

This period shall be reduced to 24 hours on well-founded emergency grounds in the

application for authorisation of the Secretary of State-Director of the CNI, who shall

consider the aforementioned issues.

The Senior Judge shall stipulate that everything which allows the safeguarding of its

actions will be classified secret. The Secretary of State-Director of the CNI shall order

the immediate destruction of material regarding all information which, while obtained

through the previous authorisation mentioned above, has nothing to do with its object

or purposes.

EU Judicial Parliamentary Executive Expert None

EU Member State No powers Same powers (as

over other data

controllers)

Limited powers

ES X

EU Member State No powers Same powers (as

over other data

controllers)

Limited powers

ES X

18

Member

State

bodies

ES X

1.5.10 Table 5. Approval of signals intelligence in France, Germany, the Netherlands,

Sweden and the United Kingdom

Spain: N.A.

1.5.11 Figure 5: Remedial avenues at the national level

In accordance with Article 24 of the Spanish Constitution, every person has the right to obtain

effective protection of the Judges and the Courts in the exercise of his or her legitimate rights

and interests, and in no case may he/she go undefended. In this sense, any citizen considering

his/her fundamental rights have been violated can request the protection of these rights before

ordinary courts by means of a proceeding based on the principles of preference and summary,

and, when appropriate, by means of an appeal for legal protection before the

Constitutional Court.

The Ombudswoman has no executive power, but the will to influence. This is a mediating

institution between citizens and public administrations, which is neutral and active, with

autoritas, but not potestas.

Despite not having executive power, they have four other powers:

1) They can make an appearance at any public office;

2) They can interview any public official even under protest;

3) They can interview any person imprisoned, even under protest ;

4) They can gain access to any kind of document.

???

Data

protection

authority

(DPA)

Ombudsperson

institutions Courts (ordinary and/or

specialised)

19

The Spanish Constitutional Court (Resolution of 2015) dismissed all the complaints of

infringement of the fundamental rights regarding the code of criminal procedure.

People register their complaints with the General Council of the Spanish Judiciary. They are

responsible for the inspection of both courts of law and of justice27.

1.5.12 Figure 6: Types of national oversight with powers to hear individual complaints

in the context of surveillance, by EU Member states

Spain: N.A.

The Spanish Data Protection Agency has no power over the Intelligence Services. The

authority over the intelligence services is nil. The Organic Law on Data Protection excludes

"reserved matters", which means that the law applies to the intelligence agencies, given that

their matters are reserved28.

No national authority oversight with the power to hear individual complaints in the context of

surveillance exists in Spain.

19 27 See the complete interview in Annex IV 28 See the complete interview in Annex I